Confidentiality of 
Census data 


The guarantee of the Act 


The Census collects information relating to each person and household in Australia. It is taken to provide a 
snapshot of information about the community as a whole and about groups within the community. However, it is 
not concerned with information about individuals. The public expects that the information they provide will be kept 
confidential, and this is ensured by provisions in the Census and Statistics Act 1905. Under this Act, all ABS 
officers (including temporary employees working during the Census) are legally bound never to release identifiable 
personal information to any person or organisation outside the ABS. 


Section 19 of the Act makes it an offence for any past or present ABS officer to divulge, either directly or indirectly, 
any confidential information collected under this Act. The Act provides for heavy penalties (fines of up to $13,200 
or imprisonment for two years or both) for anybody convicted of breaching this obligation — even if they are no 
longer employed by the ABS. 


In accordance with the Act, no results will be released in a way which would enable particular individuals or 
households to be identified. In addition, the ABS is obligated to comply with the principles set out under the 
Privacy Act 1988. 


This fact sheet covers the following issues: 


¢ security arrangements 
e retention of name-identified information 
e confidentiality of tabular data. 


Security arrangements during collection and processing 


For the Census, strict measures are taken in field collection, processing and output of data to guard against the 
release of confidential information. Census Collectors are responsible for ensuring the Census forms for their 
Collector Workload are secure at all times. 


The ABS also protects householders’ privacy during the collection of the Census forms. Householders who do not 
wish other members of the household to see their information may request a personal Census form. Those who 
are concerned about the Census Collector seeing their form can ask for a privacy envelope or can complete the 
Census form online using the eCensus. Householders who still have concerns can ask their Census Collector for 
a reply-paid mailback envelope to post their completed form directly to the ABS. 


Completed Census forms are transferred from the collection centres to the Census Data Processing Centre under 
secure arrangements. Full-time security personnel are employed to prevent any unauthorised access to the 
processing centre. After processing of the forms has been completed, they are pulped under the supervision of an 
officer of the ABS. All records used by Census Collectors are destroyed. 


Comprehensive security arrangements are implemented on the ABS computer system. These include the use of 
regularly changed passwords, access control and audit trails. 


The eCensus is the electronic option for returning your Census form, which allows you to complete the Census via 
the Internet. To ensure that your information is delivered to the ABS free of tampering, we use the strongest 
encryption technology that current browsers will support. The eCensus data sent to the ABS via the Internet are 
not able to be read by anyone other than the ABS. At the end of the Census, the hard disk drives used to store 
information will be thoroughly wiped under the supervision of the ABS to ensure there is no possibility of any 
Census data being accessed by any unauthorised person. 


Retention of name-identified information 


Prior to the 2001 Census, all name-identified information was destroyed once the statistical processing was 
completed. However, for the 2001 and subsequent Censuses, respondents have been given the choice of having 
their name-identification information archived for the research use of future generations. 


This change came about when the Government accepted the recommendation of the Standing Committee on 
Legal and Constitutional Affairs report, Saving Our Census and Preserving_Our History that saving name-identified 
Census information ‘for future research, with appropriate safeguards, will make a valuable contribution to 
preserving Australia's history for future generations’. This was particularly true for the 2001 Census as it coincided 
with the Centenary of Federation. 


In order to ensure that the current high levels of public confidence and cooperation in the Census are maintained, 
and to respect the wishes of those who do not want their information retained for future release, information is only 
kept for those persons who explicitly give their consent. If a person does not explicitly agree to their name- 
identified Census information being retained, their name and address is destroyed once statistical processing has 
been completed. 


The retained name-identified information is not available for any purpose, including use by a court or tribunal, 
within a 99 year closed access period. Retained name-identified information from the 2011 Census will become 
publicly available in the year 2110. 


Confidentiality of tabular data 


Tables containing cells with very small counts may potentially result in an individual being identified. Consequently, 
all tables are subjected to confidentiality processes before release. These steps are taken to avoid releasing 
information that may identify particular individuals, families, households or dwellings, without impairing the 
usefulness of the tables. 


Introduced random error 


For the 2006 Census, a new technique was developed to avoid identification of individuals. The confidentiality 
technique applied by the ABS is to slightly adjust all cells to prevent any identifiable data being exposed. These 
adjustments result in small introduced random errors. The technique allows very large tables, for which there is a 
strong client demand, to be produced even though they contain numbers of very small cells. Details of the exact 
nature of the methodology applied are available from the ABS on request. 


Modifications are made to totals and subtotals to preserve additivity within tables. Tables which have been 
randomly adjusted will be internally consistent. However, comparisons with other tables containing similar data 
may show minor discrepancies. This is the case for both customised tables and standard products. These small 
variations can, for the most part, be ignored. 


Care should be taken when specifying tables to minimise the number of small cells. No reliance should be placed 
on small cells. Aside from the effects of introduced random error, possible respondent and processing errors have 
greatest relative impact on small cells. 


More information on random error in particular can be found in the glossary entry Introduced random error in the 
2011 Census Dictionary (cat. no. 2901.0). More general information on data quality can be found in the same 


For more information about privacy and confidentiality, visit the Privacy & confidentiality page 


